topic FW Outbound policy in Next-Generation Firewall Discussions

FW Outbound policy

chens — Mon, 22 Apr 2024 20:24:19 GMT

What is the best practice policy outbound from the FW itself (i.e management )?

Allow any out? *.palotalto.com?

Re: FW Outbound policy

Claw4609 — Tue, 23 Apr 2024 17:02:35 GMT

Hello,

It depends on what your needs would be and how locked down you want to be. For example if you use Stata Logging Service (Cortex Data Lake) There are things like *.gpcloudservice.com and ocsp.godaddy.com needed. Personally I would just recommend doing it by app-id, for the Palo services that are various app-ids for the services and the documentation should list it. For example, here is Strata Logging Services:

TCP Ports and FQDNs Required for Strata Logging Service (paloaltonetworks.com)

Re: FW Outbound policy

S_Williams901 — Tue, 07 May 2024 18:43:07 GMT

Create a custom URL list with all the palo FQDNs they recommend, make sure you have service route configured correctly if using anything other than Mgmt. Then use all the palo app-id selections with application default. Watch the logs over a few day for any URLs its trying to hit that might be palo related. Also use policy optimizer to slim down your app usage and rid of any apps your policy isn't using.

Re: FW Outbound policy

OtakarKlier — Tue, 07 May 2024 20:45:45 GMT

Hello,

Along with the above already mentioned, disable all content inspection and ssl decryption, etc.

Regards,